Skip to main content
Glama
vuongdat67

MCP SSDLC Security Toolkit

by vuongdat67

MCP SSDLC Security Toolkit v2.0

CI License: MIT Node.js TypeScript

An intelligent, domain-aware Security Software Development Life Cycle (SSDLC) toolkit powered by the Model Context Protocol (MCP). It helps Tech Leads, Security Engineers, and Developers orchestrate secure software design, generate pseudocode, and manage compliance.

🌟 Key Features

  • Domain-Agnostic Core: Built-in support for Healthcare (HIPAA), Fintech (PCI-DSS), Blockchain, Secure Communications, and 12+ more domains. Easily extensible to ANY domain via YAML plugins.

  • Tech Lead Automation: Generates Pseudocode (Python, TS, Java, Go, C#, C++, Rust), Architecture Diagrams (Mermaid), DFD/ERD, and Module Breakdowns from user stories.

  • Full Pipeline Orchestration: One command to run BA β†’ Tech Design β†’ Threat Modeling β†’ QA Strategy β†’ CI/CD Planning β†’ ADR Generation.

  • Multi-format Export: Output to JSON, YAML, Markdown, or professional SRS documents.

Related MCP server: Phantom MCP

πŸ“‹ Table of Contents

πŸš€ Getting Started

Prerequisites

  • Node.js v18+

  • pnpm (recommended) or npm

Installation

# Clone the repository
git clone https://github.com/vuongdat67/mcp_ssdlc
cd mcp-ssdlc-security-toolkit

# Install dependencies
pnpm install

# Build the project
pnpm build

πŸ’» Configuration

Claude Desktop App

Add to your Claude Desktop configuration:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "ssdlc-toolkit": {
      "command": "node",
      "args": ["path/to/mcp-ssdlc-security-toolkit/dist/index.js"]
    }
  }
}

VS Code

The project includes .vscode/mcp.json for automatic configuration.

Docker

# Build and run with Docker
docker build -t mcp-ssdlc-toolkit .
docker run -it mcp-ssdlc-toolkit

# Or use docker-compose
docker-compose up ssdlc

πŸ› οΈ Available Tools

Tool

Description

list_domains

List all available domain plugins

load_domain

Load a specific domain

detect_domain

Auto-detect domain from description

ba_analyze_requirements

Generate user stories and security requirements

techlead_design

Generate technical design and pseudocode

security_threat_model

Generate STRIDE threat model

qa_design_test_strategy

Generate test strategy

devops_design_cicd

Generate CI/CD pipeline

orchestrate_ssdlc_pipeline

Run complete SSDLC pipeline

🌍 Domains

Built-in Domains

Domain

Compliance

Use Case

healthcare

HIPAA

Patient records, telemedicine

fintech

PCI-DSS

Payments, banking

blockchain

-

Smart contracts, DeFi

secure_comm

GDPR

E2EE messaging

appsec

OWASP

Security tooling

ml_ai

-

ML model security

malware_analysis

-

Malware research

And 10+ more...

Custom Domains

Create custom domains by adding YAML files to domains/custom/:

# domains/custom/ecommerce/domain.yaml
name: "ecommerce"
keywords: ["shop", "cart", "checkout"]
stakeholders:
  - name: "Shopper"
    type: "end_user"
sensitiveData:
  - type: "Payment Data"
    level: "critical"

🐳 Docker

# Development mode
docker-compose up ssdlc-dev

# Production mode
docker-compose up ssdlc

# Run tests
docker-compose run test

πŸ“š Documentation

Full documentation available in the docs/ directory:

🀝 Contributing

We welcome contributions! See CONTRIBUTING.md for guidelines.

# Run tests
pnpm test

# Run with coverage
pnpm test:coverage

# Lint
pnpm lint

πŸ—ΊοΈ Roadmap

See ROADMAP.md for planned features:

  • v2.1: AI Integration, Interactive CLI, Domain Marketplace

  • v2.5: Real-time Collaboration, Version Control, Third-party Integrations

  • v3.0: Visual Domain Designer, SBOM, Threat Intelligence Feeds

πŸ› οΈ Tech Stack

Feature

Supported Options

Pseudocode Language

Python, TypeScript, Java, Go, C#, C++, Rust

Cloud Target

Kubernetes, AWS, Azure, GCP, Docker

Repo Platform

GitHub, GitLab, Bitbucket

Export Formats

JSON, YAML, Markdown, SRS

πŸ€– Orchestration Example

Ask your AI assistant:

"Design a secure E-wallet system for fintech. Use TypeScript and deploy to AWS. Run the full SSDLC pipeline."

The agent will call orchestrate_ssdlc_pipeline and generate:

  • User stories and security requirements

  • Technical design with pseudocode

  • STRIDE threat model

  • Test strategy

  • CI/CD pipeline

  • Architecture Decision Records (ADRs)

  • Project plan with cost estimation

πŸ“„ License

This project is licensed under the MIT License - see the LICENSE file for details.


Made with ❀️ by the MCP SSDLC team

Available Tools

17 tools
analyze_code_securityC

Analyze code for security issues and vulnerabilities

ParametersJSON Schema
NameRequiredDescriptionDefault
codeYesCode to analyze
domainNoDomain context (healthcare, fintech, etc.)
languageYesProgramming language

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description does not disclose behavioral traits such as whether it is read-only, requires network access, or has side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, clear sentence without unnecessary words. It is appropriately concise, though could benefit from a bit more detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema is provided, and the description does not explain the output format, types of issues detected, or how to interpret results. This leaves significant gaps for a security analysis tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for each parameter. The tool description adds no additional meaning beyond the schema, meeting the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it analyzes code for security issues and vulnerabilities, but does not differentiate from similar sibling tools like 'security_threat_model' or 'get_secure_template'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. No mention of prerequisites, limitations, or recommended scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ba_analyze_requirementsC

Generate user stories, security requirements, and abuse cases

ParametersJSON Schema
NameRequiredDescriptionDefault
domain_nameNoOptional domain name
business_goalsYes
project_descriptionYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries full burden. It only lists outputs but does not disclose any behavioral traits such as side effects, authorization needs, or constraints. The tool's behavior regarding data persistence or generation style is not mentioned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, no wasted words. However, it is minimal could benefit from slight expansion to cover usage context without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool has 3 parameters (2 required) and no output schema. The description does not explain how parameters map to outputs or what the generated artifacts look like. For a complex generation task, more context is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 33% (only 'domain_name' has a description). The description does not add meaning to parameters beyond their names. For example, 'business_goals' and 'project_description' are not elaborated on format or expected content.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb (Generate) and resource (user stories, security requirements, abuse cases). It specifies the outputs but does not differentiate from sibling tools like 'analyze_code_security' or 'security_threat_model' which may produce similar requirements.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. Does not mention prerequisites, context, or when not to use it. Sibling tools exist with overlapping functionality, yet no distinction is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

detect_domainC

Auto-detect domain from project description

ParametersJSON Schema
NameRequiredDescriptionDefault
project_descriptionYes

TDQS

C2.1/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. Description does not disclose side effects (e.g., whether it creates a domain), required permissions, or outcome. Agent cannot determine if call is safe or modifies state.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence front-loads action, but is too concise for an agent to make reliable use-call decisions. Lacks necessary details while being short.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and only one parameter, description should clarify return value (e.g., domain name, confidence score) and constraints. Completely absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% coverage for parameter descriptions. Description adds 'from project description' but does not specify expected format, length, or constraints. Parameter name alone is insufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states verb 'auto-detect' and resource 'domain' with input 'project description', indicating basic purpose. However 'domain' is ambiguous (could be internet domain or application domain) and does not distinguish from siblings like list_domains or load_domain.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives like list_domains or load_domain. Agent must infer usage solely from vague description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

devops_design_cicdC

Generate CI/CD pipeline with security gates

ParametersJSON Schema
NameRequiredDescriptionDefault
tech_stackNo
project_nameNo
deployment_targetNo
repository_platformNo

TDQS

C2.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavior. It only states the tool 'generates a pipeline' without detailing what the generation entails, authorization needs, or output characteristics. This is minimal disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that states the core purpose. It is front-loaded but lacks supporting details. It is not unnecessarily verbose, but it does not provide enough information to be considered well-structured or fully informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With four parameters, no annotations, no output schema, and only a terse description, the tool definition is severely incomplete. The agent has almost no guidance on how to use the parameters or what to expect from the tool's output, making it difficult to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not explain any of the four parameters (tech_stack, project_name, deployment_target, repository_platform). The schema provides enum values for some parameters, but the description adds no semantic help beyond the parameter names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a CI/CD pipeline with security gates, which is a specific verb and resource. It distinguishes from sibling tools like analyze_code_security or get_coding_guidelines, though it does not explicitly compare to alternatives like orchestrate_ssdlc_pipeline.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus siblings such as orchestrate_ssdlc_pipeline or security_threat_model. There is no mention of prerequisites, scenarios, or limitations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_coding_guidelinesC

Get coding guidelines and security rules for a domain

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYesDomain name
languageYesProgramming language

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must fully disclose behavior. It implies a read operation but does not specify error handling (e.g., when domain or language is invalid), authentication requirements, rate limits, or any side effects. For a retrieval tool, details on result format or potential absence of data are missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise at one sentence and eight words. It front-loads the core purpose, but omits usage guidance and behavioral details that could justify additional length. For a minimal viable description, it is efficient but could include a brief usage hint without becoming verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of output schema and annotations, the description fails to provide necessary context. It does not explain what the tool returns (e.g., a list of rules, formatted text, or JSON), how to handle missing data, or any constraints. For a retrieval tool with two parameters, the description is insufficient for an agent to use it reliably.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Both parameters are fully described in the schema with clear, self-explanatory descriptions ('Domain name', 'Programming language'). The tool description adds no additional nuance beyond the schema, so the baseline score of 3 is appropriate for 100% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool retrieves coding guidelines and security rules for a domain, using specific verbs and resources. It distinguishes from sibling tools like analyze_code_security or security_threat_model, which focus on analysis rather than retrieval. However, it could be more precise about what constitutes 'guidelines' and 'security rules'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus its siblings. There is no mention of prerequisites, typical scenarios, or cases where alternatives like analyze_code_security or security_threat_model would be more appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_last_known_goodC

Get last known good configuration that worked

ParametersJSON Schema
NameRequiredDescriptionDefault
workspace_rootYesWorkspace root directory

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the burden of behavioral disclosure. It only states the basic action without mentioning side effects, permissions, or what happens when no good config exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no wasted words. It is appropriately front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the minimal description and lack of output schema, the definition is incomplete. It does not clarify what 'last known good' means or what the return value is.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a description for workspace_root. The tool description adds no additional semantic value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the action (get) and resource (last known good configuration). It is specific enough to convey the core function, though it does not distinguish from sibling tools like workspace_snapshot.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. There is no mention of prerequisites, context, or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_secure_templateC

Get a secure code template for a feature type

ParametersJSON Schema
NameRequiredDescriptionDefault
domainNoDomain context
languageYes
feature_typeYes

TDQS

C2.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, and the description does not disclose behavioral traits such as side effects, authorization requirements, or whether the tool is read-only. The description merely states the operation without additional context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, which is concise but incomplete. It lacks structure, such as separating purpose from usage notes, and does not use the limited space effectively to convey necessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema, 3 parameters with low schema coverage, and no annotations. The description fails to explain return values, error handling, or usage patterns, making it insufficient for an agent to understand the tool's full behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With only 33% schema description coverage, the tool description adds no meaning beyond the schema. It does not explain the purpose of 'domain', 'language', or 'feature_type' parameters. The schema's description for 'domain' ('Domain context') is vague, and the tool description fails to elaborate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Get a secure code template for a feature type', which clearly identifies the verb ('get') and resource ('secure code template'). It distinguishes from sibling tools that focus on analysis, design, or diagnostics. However, it doesn't specify what type of template or its format.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. The description lacks context about prerequisites, appropriate feature types, or when to prefer this over other tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_domainsB

List all available domain plugins

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description bears full responsibility for behavioral disclosure. It fails to mention that this is a read-only operation, whether it requires authentication, or what 'available' means in terms of state (e.g., installed, enabled). The agent is left to assume it is safe and fast.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single short sentence that communicates the core functionality without any unnecessary words. It is appropriately sized for a simple list operation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no output schema), the description is largely complete. It could marginally benefit from clarifying what 'domain plugins' are and whether the list reflects system status or user context, but current level is sufficient for a basic list operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the schema coverage is 100% (effectively). According to guidelines, zero parameters earns a baseline of 4. No additional parameter information is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('List') and resource ('all available domain plugins'). It is explicit enough to distinguish from sibling tools like 'detect_domain' or 'load_domain'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives such as 'detect_domain' or 'load_domain'. The description does not mention prerequisites, context, or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

load_domainC

Load a specific domain plugin

ParametersJSON Schema
NameRequiredDescriptionDefault
domain_nameYesDomain name (healthcare, fintech, generic)

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility. It only states 'Load', giving no indication of side effects, permissions required, or what happens after loading. This is insufficient for a tool that likely mutates state.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, which is concise. However, it may be too terse and lacks structured detail. It could benefit from elaboration without being overly long.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has one required parameter, no output schema, and no annotations, the description should provide more context about what a domain plugin is, what loading entails, and expected outcomes. It falls short.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% (the parameter domain_name is described). The main description adds no extra meaning beyond the schema; the schema already lists example values. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Load') and the resource ('a specific domain plugin'). It is specific enough but does not differentiate from sibling tools like 'detect_domain' or 'list_domains', which have overlapping themes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. There is no mention of prerequisites, context, or scenarios where loading a domain plugin is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

orchestrate_ssdlc_pipelineC

Run complete SSDLC pipeline from project description

ParametersJSON Schema
NameRequiredDescriptionDefault
tech_stackYes
business_goalsYes
target_languageNo
deployment_targetNo
project_descriptionYes
compliance_requirementsNo

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided. The description implies a potentially long-running or destructive process but offers no details on side effects, required permissions, or what changes are made.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence is concise but lacks substance. It could be expanded to include key details without becoming verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 6 parameters, no output schema, and no annotations, the description fails to explain the pipeline's behavior, outputs, or parameter roles. Severely incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%. The description only mentions 'project description' but ignores five other parameters including enums. No meaning added beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'run' and the resource 'complete SSDLC pipeline', differentiating it from sibling tools like 'analyze_code_security' or 'techlead_design'. However, it lacks specificity on what the pipeline entails.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like 'techlead_design' or 'security_threat_model'. No prerequisites or exclusions are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

parse_error_logC

Parse error log to extract issues and suggestions

ParametersJSON Schema
NameRequiredDescriptionDefault
log_typeNoType of log
log_contentYesError log content to parse

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey behavioral traits. It implies a read-only operation ('parse'), but does not explicitly state it is non-destructive, safe, or free of side effects. The lack of explicit safety disclosure reduces transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that conveys the core purpose without unnecessary words. It is appropriately sized but could benefit from slightly more detail, hence not a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 2 simple parameters and no output schema. The description gives the overall purpose but does not mention output format or what 'issues and suggestions' entails. With several sibling tools, additional context would improve completeness, but it is minimally adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with both parameters described (log_content and log_type). The description adds no extra meaning beyond these schema descriptions. Baseline score of 3 is appropriate as the schema already conveys parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Parse error log to extract issues and suggestions'. The verb 'parse' and resource 'error log' are specific, and it distinguishes from sibling tools like analyze_code_security or detect_domain. However, it does not specify the type of issues or suggestions, leaving some ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, such as when to choose it over analyze_code_security or run_diagnostic_playbook. It solely states the function without contextual usage cues.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

qa_design_test_strategyC

Generate test cases from features and threats

ParametersJSON Schema
NameRequiredDescriptionDefault
threatsNo
featuresNo
compliance_requirementsNo

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It merely states 'generate test cases' without disclosing whether the tool is read-only, destructive, requires authentication, or what the output format is. This is insufficient for a tool with no annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, which is concise, but it omits critical information. It is not overly verbose, but the brevity comes at the cost of completeness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 3 undocumented parameters, no output schema, and no annotations. The description does not explain how test cases are generated, what the output looks like, or any dependencies. It is far from sufficient for correct use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description should explain the parameters. It lists 'threats', 'features', and 'compliance_requirements' but provides no details on their structure or expected values. The agent cannot infer proper inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action: 'Generate test cases from features and threats'. It specifies the verb (generate) and resource (test cases). However, it does not distinguish this tool from siblings like security_threat_model, which might also involve threats.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, when not to use it, or suggest which sibling tools might be more appropriate for related tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_diagnostic_playbookC

Run a diagnostic playbook to check/fix environment issues

ParametersJSON Schema
NameRequiredDescriptionDefault
playbookYesPlaybook to run
workspace_rootYesWorkspace root directory

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It mentions 'fix' implying mutation, but does not disclose whether the tool modifies the environment, requires permissions, or has side effects. Important behavioral details are missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is front-loaded and contains no redundant words. It is appropriately sized for a simple tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and the tool's potential to modify the environment, the description is incomplete. It does not explain what the tool returns, whether it is idempotent, or any post-conditions. More context is needed for safe usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 100%, the parameter descriptions are minimal. The description adds no extra meaning beyond the schema (e.g., explaining enum values or workspace_root usage). A baseline of 3 is not earned because the description fails to clarify parameter behavior or selection criteria.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool runs a diagnostic playbook to check/fix environment issues, with a specific verb and resource. However, it does not differentiate from the sibling tool 'run_environment_diagnostics', which likely has overlapping functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives (e.g., run_environment_diagnostics, parse_error_log), nor are prerequisites or situational use cases mentioned. The description lacks explicit usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_environment_diagnosticsC

Run diagnostics to check development environment (Node, Git, build tools)

ParametersJSON Schema
NameRequiredDescriptionDefault
workspace_rootYesWorkspace root directory

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must disclose behavioral traits. Only states 'run diagnostics' without indicating side effects, return format, or whether it modifies anything. For a diagnostic tool, read-only behavior should be explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence, no unnecessary words. Concise and front-loaded with the action and target, though additional detail would improve its utility.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description is too minimal. It does not explain output format, error handling, or how to interpret results, which is crucial for a diagnostic tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a single self-explanatory parameter 'workspace_root'. Description does not add extra meaning beyond the schema, but baseline is 3 due to high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states 'run diagnostics' and lists the components checked (Node, Git, build tools). Distinguishes from sibling 'run_diagnostic_playbook' by specifying development environment focus, but could be more precise about the scope of diagnostics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives like 'run_diagnostic_playbook' or prerequisites. Does not mention cases where diagnostics might fail or when to avoid running.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

security_threat_modelC

Generate STRIDE threat model from modules

ParametersJSON Schema
NameRequiredDescriptionDefault
modulesNo
domain_nameNo
project_nameNo

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description bears full burden. It only says 'generate a STRIDE threat model from modules' but does not disclose behavioral traits like whether it is read-only, requires prerequisites, or what side effects occur.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence and front-loaded, which is concise. However, it is under-specified for the tool's complexity, so it does not earn full marks for conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 0% schema description coverage, no output schema, and no annotations, the description is insufficient. It fails to explain return values or parameter usage, making it incomplete for an agent to use effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description adds no information about parameters. It does not explain what 'modules', 'domain_name', or 'project_name' mean, leaving the agent without necessary context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Generate' and resource 'STRIDE threat model', clearly indicating the tool's function. It distinguishes from sibling tools like 'analyze_code_security' by focusing on threat modeling, but does not explicitly differentiate.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. The description only states the action without providing context for appropriate use cases or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

techlead_designC

Generate feature checklist, flows, modules, pseudocode, architecture diagram

ParametersJSON Schema
NameRequiredDescriptionDefault
project_nameNo
user_storiesNo
export_formatNo
target_languageNo
security_requirementsNo

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It only states what the tool generates but reveals nothing about side effects, permissions required, input expectations, or output format. For a tool producing multiple artifacts, more behavioral context (e.g., whether it saves to workspace, what happens with missing inputs) is needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that efficiently lists the key outputs. It is front-loaded with the verb and target items. However, it could be slightly more structured (e.g., separating input expectations from outputs) without adding length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 5 optional parameters, no output schema, and 16 sibling tools, the description is incomplete. It doesn't specify what the tool returns, how parameters affect behavior, or how it fits into a design workflow. For example, users don't know if 'export_format' controls the output or if 'target_language' changes pseudocode style.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not mention any parameters, while the schema has 5 parameters (including project_name, user_stories, export_format) with 0% schema description coverage. The description adds no meaning beyond the schema; it fails to explain how parameters like 'user_stories' or 'security_requirements' influence the generated design.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the verb 'Generate' and lists specific outputs (feature checklist, flows, modules, pseudocode, architecture diagram), making the tool's purpose clear. However, it does not differentiate from similar sibling tools like 'ba_analyze_requirements' or 'qa_design_test_strategy', missing a chance to specify its unique scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, no prerequisites, and no exclusions. For example, it doesn't clarify whether this tool is for initial design vs. detailed implementation, or when to prefer it over sibling tools like 'security_threat_model'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

workspace_snapshotA

Generate a snapshot of the workspace structure (file tree with .gitignore filtering)

ParametersJSON Schema
NameRequiredDescriptionDefault
max_depthNoMaximum depth to scan (default: 5)
root_pathYesRoot directory to scan

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must convey behavioral traits. It mentions '.gitignore filtering' which specifies a key behavior, but does not disclose potential side effects (e.g., read-only, performance for large directories) or whether it follows symlinks. Adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that front-loads the action ('Generate a snapshot') and adds the key filtering context. No unnecessary words or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has only two parameters and no output schema. The description covers the main output behavior (file tree with gitignore filtering), which is likely sufficient for an agent to understand what to expect. Minor gaps: no mention of output format or depth limitations beyond the optional max_depth parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description does not add extra meaning to the parameters beyond what the schema already provides (root_path and max_depth are self-explanatory in the schema).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Generate' and a clear resource 'snapshot of workspace structure (file tree with .gitignore filtering)'. It distinguishes itself from sibling tools which are mostly analysis/design-oriented, making its purpose distinct and easy to understand.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives (like get_coding_guidelines or parse_error_log). While it may be a prerequisite for workspace analysis, this is not explicitly stated, leaving the agent without explicit selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 17 tool updatesv2.0.0
    • First observedanalyze_code_security
    • First observedba_analyze_requirements
    • First observeddetect_domain
    • First observeddevops_design_cicd
    • First observedget_coding_guidelines
    • First observedget_last_known_good
    • First observedget_secure_template
    • First observedlist_domains
    • First observedload_domain
    • First observedorchestrate_ssdlc_pipeline
    • First observedparse_error_log
    • First observedqa_design_test_strategy
    • First observedrun_diagnostic_playbook
    • First observedrun_environment_diagnostics
    • First observedsecurity_threat_model
    • First observedtechlead_design
    • First observedworkspace_snapshot

TDQS

B3/5.0
Disambiguation4/5

Most tools have clearly distinct purposes, but there is minor overlap between run_diagnostic_playbook and run_environment_diagnostics, and between get_coding_guidelines and get_secure_template. Descriptions are clear enough to differentiate.

Naming Consistency4/5

The majority of tools follow a consistent verb_noun pattern (e.g., analyze_code_security, list_domains). However, two tools (security_threat_model, workspace_snapshot) deviate by omitting a verb, creating a minor inconsistency.

Tool Count5/5

With 17 tools, the server is well-scoped for a security toolkit covering requirements, design, threat modeling, code analysis, CI/CD, testing, diagnostics, and domain management. Each tool earns its place.

Completeness4/5

The toolset covers major SSDLC phases (requirements, design, implementation guidance, analysis, testing, CI/CD). Minor gaps exist, such as lack of deployment security scanning or compliance checks, but core workflows are supported.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Integrates SAST, DAST, IAST, and SCA security testing tools for AI-powered DevSecOps automation, enabling comprehensive security scanning and reporting through natural language interfaces.
    17
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables authorized compliance verification and security auditing through natural language, bridging AI assistants with industry-standard security tools for enterprise audits.
    24
    -
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI-powered security scanning of codebases through conversational analysis, allowing users to assess, threat model, code review, DAST test, and generate security reports using natural language with Claude.
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Integrates authoritative security compliance frameworks (ISO 27001, NIST 800-53, OWASP ASVS, NIST SSDF) into AI-assisted development, offering control lookups, cross-framework mappings, build-time guardrails, and automated audit evidence generation.
    169
    3
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/vuongdat67/mcp_ssdlc'

If you have feedback or need assistance with the MCP directory API, please join our Discord server